Vulnerabilities

TI-2026-45282 CVE-2026-63640 · GHSA-q4gh-4ffp-5cg8

MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MEDIUM 53

MagicMirror² is an open source modular smart mirror platform.

CVSS 3.1MEDIUM 4.3 Adjacent network No auth No interaction EPSS 0.00298 Published 2026-08-18 Fixed in 2.37.0 CWE-200

TI-2026-45284 CVE-2026-63642 · GHSA-998g-7v5w-cr7g

HIGH 69

MagicMirror² is an open source modular smart mirror platform.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00496 Published 2026-08-18 Fixed in 2.37.0 CWE-918

TI-2026-45285 CVE-2026-63643 · GHSA-w6x9-28jw-hq7j

LOW 29

MagicMirror² is an open source modular smart mirror platform.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00665 Published 2026-08-18 Fixed in 2.37.0 CWE-441

TI-2026-45283 CVE-2026-63641 · GHSA-w26r-fwg8-rcp3

MEDIUM 45

MagicMirror² is an open source modular smart mirror platform.

CVSS 4.0LOW 2.3 Adjacent network No auth No interaction EPSS 0.00433 Published 2026-08-18 Fixed in 2.37.0 CWE-284